Curious how other banks have this set up.

Current bank is 400M and rapidly growing, The Compliance and Risk Management Officer is the Compliance Officer, BSA Officer, CRA Officer, SAFE Act Officer, Customer Complaint Officer - essentially everything except the Security Officer. The CRMO is also responsible for conducting all internal and compliance audits as well as the monthly, quarterly, semi annual and annual monitoring and risk assessments and the daily functions of CTR filings, SAR filings, credit reporting disputes, subpoenas, etc. There is no one else covering the daily functions. External audit comes in for BSA every 18 months.

What is your bank size and how are these responsibilities covered at your institutions? We are having some growing pains and I'm looking for information to help develop a plan going forward. Thanks for your input!

Perhaps I'm misunderstanding. The person responsible for executing the tasks for CRA, BSA, Compliance, etc. is also the same person auditing those functions?

For smaller institutions, the regulators usually over look some auditor independence issues - outside of BSA/AML of course. The larger the institution, the more pressure you will see on the independence issue.

Yes - same person for all but BSA. I understand the independence issue but this is how the previous CO set up the program. Now that I have come into it, I'm trying to put the case together for how this is not appropriate but it's a struggle to present it in a way that's going to be effective in getting them separated. It would mean outsourcing it again or hiring an independent auditor.

Well, from personal experience in small banks, if the status quo of the bank remains the same, then getting management to budge is going to be difficult, unless the regulators start pushing them to develop more independence. If the bank has its eyes on growing into a larger bank, then the regulators are going to force their hand and it is going to be a little harder than a push. If they plan on a merger with another bank and they will be the surviving entity, without an adequate internal control process, such an endeavor is going to present some hurdles in order to receive regulator approval.

How small of a bank are you? When I was at $100 million bank we had to outsource IA for a number of items (Including BSA). Randy is probably right though. If there is no pressure from your regulatory partners and there isn't some triggering event (Growth, M&A, etc.) you're probably going to have a hard time getting budget for this.

I was at a 250 million bank with both audit and compliance separately reporting to the board.